Skip to content

Commit aa8d3a8

Browse files
remicolletJulien Pauli
authored and
Julien Pauli
committed
fix the fix for bug #70976 (imagerotate)
1 parent a6734f7 commit aa8d3a8

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed

ext/gd/libgd/gd_interpolation.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2154,15 +2154,15 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
21542154
{
21552155
const int angle_rounded = (int)floor(angle * 100);
21562156

2157-
if (bgcolor < 0 || (!src->trueColor && bgcolor >= gdMaxColors)) {
2157+
if (bgcolor < 0) {
21582158
return NULL;
21592159
}
21602160

21612161
/* impact perf a bit, but not that much. Implementation for palette
21622162
images can be done at a later point.
21632163
*/
21642164
if (src->trueColor == 0) {
2165-
if (bgcolor >= 0) {
2165+
if (bgcolor < gdMaxColors) {
21662166
bgcolor = gdTrueColorAlpha(src->red[bgcolor], src->green[bgcolor], src->blue[bgcolor], src->alpha[bgcolor]);
21672167
}
21682168
gdImagePaletteToTrueColor(src);

ext/gd/tests/bug70976.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
66
?>
77
--FILE--
88
<?php
9-
$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
9+
$img = imagerotate(imagecreate(10,10),45,0x7ffffff9);
1010
var_dump($img);
1111
?>
1212
--EXPECTF--
13-
bool(false)
13+
resource(5) of type (gd)

0 commit comments

Comments
 (0)